masslogger

General

Target

3d9944fadf6c7c728f797cc56bed01e2c590e767239e04fcd007306e7bf0a419
Size

813KB
Sample

220521-ay91tabae7
MD5

c2b2d22d361a86ea2aa8b0effd629005
SHA1

fc8484f056cfbfd13a8f12749c5eb20018ce1b2a
SHA256

3d9944fadf6c7c728f797cc56bed01e2c590e767239e04fcd007306e7bf0a419
SHA512

516fee8eec52199b408f401374a816f82c84984260b3dcd81d7c3ea9e5a2f659d278f2b52c05d5c5f109020a373507769d18021d3e8a5926915b5381792bdef5

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\AEF946DCB4\Log.txt

Family

masslogger

Ransom Note

<|| v2.1.0.0 ||> User Name: Admin IP: 127.0.0.1 Location: United States Windows OS: Microsoft Windows 7 Ultimate 64bit Windows Serial Key: D4F6K-QK3RD-TMVMJ-BBMRX-3MBMV CPU: Intel Core Processor (Broadwell) GPU: Standard VGA Graphics Adapter AV: NA Screen Resolution: 1280x720 Current Time: 5/21/2022 2:57:46 AM MassLogger Started: 5/21/2022 2:57:31 AM Interval: 2 hour MassLogger Process: C:\Users\Admin\AppData\Local\Temp\Anti Markietng Purchase Order Sheets.exe MassLogger Melt: false MassLogger Exit after delivery: false As Administrator: True Processes: <|| WD Exclusion ||> Disabled <|| Binder ||> Disabled <|| USB Spread ||> Disabled <|| Downloader ||> Disabled <|| Window Searcher ||> Disabled <|| Bot Killer ||> Disabled <|| Search And Upload ||> Disabled <|| Telegram Desktop ||> Not Installed <|| Pidgin ||> Not Installed <|| FileZilla ||> Not Installed <|| Discord Tokken ||> Not Installed <|| NordVPN ||> Not Installed <|| Outlook ||> Not Installed <|| FoxMail ||> Not Installed <|| Thunderbird ||> Not Installed <|| FireFox ||> Not Found <|| QQ Browser ||> Not Installed <|| Chromium Recovery ||> Not Installed or Not Found <|| Keylogger And Clipboard ||> Disabled

Targets

- Target
  
  Anti Markietng Purchase Order Sheets.exe
- Size
  
  1.0MB
- MD5
  
  879f8158a062005bd3976a45233f8c69
- SHA1
  
  d6c3f71339d930006117125c007e2ea199e221f6
- SHA256
  
  3f97dfbae448b3eb28d6f08f666029037d890dc94dbce0e372b4dd2a63fd037f
- SHA512
  
  306f0f81cc26e2108ab1270be6eb9f1842539079ea174e471a0019b97078df54f257e735cde6d2e076373473d4612bf5f0835e00a963da7b0999fceb216931d9
Score

10^/10

masslogger collection ransomware spyware stealer
- MassLogger
  Masslogger is a .NET stealer targeting passwords from browsers, email and cryptocurrency clients.
  stealer spyware masslogger
- MassLogger log file
  Detects a log file produced by MassLogger.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2